Remove the quarantine from downloaded applications

Issue:
OS X tags files downloaded from the web, and asks for confirmation before running a downloaded application or script.

While this does provide a default layer of security against running downloaded programs, it is also annoying for people who already exercise an appropriate level of caution about trusting downloaded software. How can I disable or circumvent this behavior?

Solution:
It is important to realize that the OS X quarantining behavior does not do anything with regard to checking downloaded files for viruses, preventing malicious software from running, etc. All it does is remind you that it was downloaded – and require an extra button-click – before the downloaded application can start. (Updated: not entirely true! It also checks for known malware in OS X 10.6 Snow Leopard and later – see https://support.apple.com/en-us/HT201940.) Also, note that this is a separate issue from the Gatekeeper behavior in OS X 10.8 Mountain Lion and later (also see http://mac.tutsplus.com/tutorials/security/gatekeeper-in-mountain-lion-what-you-need-to-know/). Quarantining can, apparently, still affect applications that have already successfully made it through Gatekeeper because they satisfy the Gatekeeper trust settings.

Since (approximately) OS X 10.5.5 Leopard, I no longer noticed the really annoying aspect of quarantining; namely, that it asked for confirmation every time any given application or file that was downloaded from the web was subsequently opened. This changed to asking only the first time the application or file is opened, which is much more sensible and less annoying. Consequently, I stopped trying to circumvent this behavior. However, for the more easily annoyed (and self-vigilant!), to completely turn off the quarantine behavior, issue the following command in a Terminal window, and then reboot.

defaults write com.apple.LaunchServices LSQuarantine -bool NO

Repeat with YES instead of NO to turn the quarantine back on.

An initial impression is this sounds like a dangerous thing to do; after all, isn't the quarantine protecting me from ... something? Well, remember the caveat noted above: quarantine doesn't detect malicious software or prevent it from running – all it does is remind you that a given piece of software came from the wild web and could be dangerous (or might be completely harmless). There is a line of reasoning that supports the idea that turning off quarantine altogether is better for promoting security. This is because, over time, the quarantining behavior simply trains even the most careful user to automatically click that annoying pop-up window out of the way without actually thinking about it.

Personally, as noted above, I am not overly annoyed by having to click off the quaratine window exactly once per afflicted software title. However, I noticed under OS X 10.8.2 Mountain Lion that if I am using an Administrator-level account, then the quarantine message shows up once for any given piece of downloaded software, and after being dismissed the first time, it stays gone – just like before, so fine, I'm not annoyed. However, another user on the same computer who is not Administrator-level sees the quarantine message every time, even if I (as Administrator) have already dismissed it for the same application. I don't know if this is new behavior in Mountain Lion or was already there in older versions of OS X – I had not tested this configuration before.

The quarantine flag can be removed from files or applications that are already downloaded, without completely disabling the quarantine mechanism, by using the following command:

xattr -d com.apple.quarantine /PATH/TO/APPLICATION

A slight shortcut is to type everything up to the path (including the trailing space) in a Terminal window, then drag the desired application or file from a Finder window into the Terminal window, which will automatically paste in the full path to the application or file. If you perform this process using an Administrator account, then the quarantine will be permanently removed for all users on the same computer, regardless of the Administrator privilege level of their accounts.